{"id":"CVE-2025-71403","aliases":["GHSA-vp58-j275-797x"],"url":"https://o3.security/vulnerability/CVE-2025-71403","summary":"better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass","details":"### Summary\n\nA bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.\n\nBecause redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.","published":"2026-08-01T12:22:18.102Z","modified":"2026-10-28T02:30:42.561081094Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"better-auth","fixedVersion":"1.1.21"}],"fix":{"url":"https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80","label":"better-auth/better-auth@b381cac"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71403.json"},{"type":"ADVISORY","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71403"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass"},{"type":"WEB","url":"https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80"},{"type":"PACKAGE","url":"https://github.com/better-auth/better-auth"},{"type":"WEB","url":"https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:42.561081094Z"}}